AIKIDO-2026-868088

TL;DR

wasm-bindgen ships a blanket UpcastFrom<&mut T> implementation that lets code widen a &mut T reference into &mut Target for any two JS bound types, without requiring the reverse cast to also be valid. Application code that performs this mutable upcast and writes a value through the widened reference can store a value whose runtime type does not match the type expected by holders of the original &mut T, a type confusion. A later read gets a value with the wrong shape, which can corrupt program state or panic. The fix requires mutual upcastability (Target: UpcastFrom<T> and T: UpcastFrom<Target>) so only sound widenings compile.